-
Zhiyi Zhang authored
push_dc_driver() places drivers based on their priorities, so the newly created driver is not necessarily on top. Thus in windrv_CreateDC(), find_dc_driver() should be used to find the DIB driver instead of assuming the DIB driver is the top driver, which could be the path driver because it has a higher priority. The exact wrong code path was: 1. A path driver with priority 400 is created for a DC. 2. windrv_CreateDC() is called to create a window driver for the DC. 3. Then in dibdrv_CreateDC(), push_dc_driver() is called with 'dev' pointing to the top driver, which is the path driver. 4. push_dc_driver() updates 'dev' to point to the address of the next driver because DIB driver has a lower 300 priority. 5. The DIB driver is assigned to 'dev', which is not the original parameter passed into push_dc_driver(). 6. In windrv_CreateDC(), get_dibdrv_pdev(*dev) is called, assuming the top driver is the DIB driver. But actually the top driver that '*dev' points to is still the path driver. The added tests can demonstrate the memory corruption before this fix is applied.
36366f12
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
tests | ||
uniscribe | ||
Makefile.in | ||
dc.c | ||
emfdc.c | ||
enhmetafile.c | ||
gdi32.rc | ||
gdi32.spec | ||
gdi_private.h | ||
icm.c | ||
metadc.c | ||
metafile.c | ||
objects.c | ||
opengl.c | ||
resource.h | ||
text.c |